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Abstract 

In this work, the critical role of noisy feedback in enhancing the secrecy capacity of the wiretap 
channel is established. Unlike previous works, where a noiseless public discussion channel is used for 
feedback, the feed-forward and feedback signals share the same noisy channel in the present model. 
Quite interestingly, this noisy feedback model is shown to be more advantageous in the current setting. 
More specifically, the discrete memoryless modulo-additive channel with a full-duplex destination node 
is considered first, and it is shown that the judicious use of feedback increases the perfect secrecy 
capacity to the capacity of the source-destination channel in the absence of the wiretapper. In the 
achievability scheme, the feedback signal corresponds to a private key, known only to the destination. 
In the half-duplex scheme, a novel feedback technique that always achieves a positive perfect secrecy 
rate (even when the source-wiretapper channel is less noisy than the source-destination channel) is 
proposed. These results hinge on the modulo-additive property of the channel, which is exploited by the 
destination to perform encryption over the channel without revealing its key to the source. Finally, this 
scheme is extended to the continuous real valued modulo-A channel where it is shown that the perfect 
secrecy capacity with feedback is also equal to the capacity in the absence of the wiretapper. 

I. Introduction 

The study of secure communication from an information theoretic perspective was pioneered 
by Shannon [1]. In Shannon's model, both the sender and the destination possess a common secret 
key K, which is unknown to the wiretapper, and use this key to encrypt and decrypt the message 
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M. Shannon considered a scenario where both the legitimate receiver and the wiretapper have 
direct access to the transmitted signal and introduced the perfect secrecy condition I(M; Z) = 0, 
implying that the signal Z received by the wiretapper does not provide any additional information 
about the source message M. Under this model, he proved the pessimistic result that the 
achievability of perfect secrecy requires the entropy of the shared private key K to be at least 
equal to the entropy of the message itself (i.e., H(K) > H(M) for perfect secrecy). Clearly, 
the distribution of the secret key under this model is challenging. 

In a pioneering work [2], Wyner introduced the wiretap channel and established the possibility 
of creating an almost perfectly secure source-destination link without relying on private (secret) 
keys. In the wiretap channel, both the wiretapper and destination observe the source encoded 
message through noisy channels. Similar to Shannon's model, the wiretapper is assumed to have 
unlimited computational resources. Wyner showed that when the source- wiretapper channel is 
a degraded version of the source-destination channel, the source can send perfectly securd_ 
messages to the destination at a non-zero rate. The main idea is to hide the information stream 
in the additional noise impairing the wiretapper by using a stochastic encoder which maps 
each message to many codewords according to an appropriate probability distribution. This 
way, one induces maximal equivocation at the wiretapper. By ensuring that the equivocation 
rate is arbitrarily close to the message rate, one achieves perfect secrecy in the sense that the 
wiretapper is now limited to learn almost nothing about the source-destination messages from its 
observations. Follow-up work by Leung- Yan-Cheong and Hellman has characterized the secrecy 
capacity of the additive white Gaussian noise (AWGN) wiretap channel [4]. In a landmark paper, 
Csiszdr and Korner generalized Wyner's approach by considering the transmission of confidential 
messages over broadcast channels [5]. This work characterized the perfect secrecy capacity of 
Discrete Memoryless Channels (DMC)s, and showed that the perfect secrecy capacity is positive 
unless the source- wiretapper channel is less noisy than the source-destination channel (referred 
to as the main channel in the sequel]^. 

Positive secrecy capacity is not always possible to achieve in practice. In an attempt to transmit 

1 Wyner's notion of per symbol equivocation is weaker than Shannon's notion of perfect secrecy [3]. 

2 The source-wiretapper channel is said to be less noisy than the main channel, if for every V — > X — » YZ, I(V; Z) > 
I(V; Y), where X is the signal transmitted by the source, and where Y and Z are the received signal at the receiver and the 
wiretapper respectively. 
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messages securely in these unfavorable scenarios, [6] and [7] considered the wiretap channel 
with noiseless feedback^!. They showed that one may leverage the feedback to achieve a positive 
perfect secrecy rate, even when the feed-forward perfect secrecy capacity is zero. In this model, 
there exists a separate noiseless public channel, through which the transmitter and receiver 
can exchange information. The wiretapper is assumed to obtain a perfect copy of the messages 
transmitted over this public channel. Upper and lower bounds were derived for the perfect secrecy 
capacity with noiseless feedback in [6], [7]. In several cases, as discussed in detail in the sequel, 
these bounds coincide. But, in general, the perfect secrecy capacity with noiseless feedback 
remains unknown. Along the same line, [8] established the critical role of a trusted/untrusted 
helper in enhancing the secret key capacity of public discussion algorithms. The multi-terminal 
generalization of the basic set-up of [6], [7] was studied in [9]. Finally, in [10]— [12], the public 
discussion paradigm was extended to handle the existence of active adversaries. 

Our work represents a marked departure from the public discussion paradigm. In our model, 
we do not assume the existence of a separate noiseless feedback channel. Instead, the feedback 
signal from the destination, which is allowed to depend on the signal received so far, is transmitted 
over the same noisy channel used by the source. Based on the noisy feedback signal, the source 
can then causally adapt its transmission scheme, hoping to increase the perfect secrecy rate. The 
wiretapper receives a mixture of the signal from the source and the feedback signal from the 
destination. Quite interestingly, we show that in the modulo-additive DMC with a full-duplex 
destination, the perfect secrecy capacity with noisy feedback equals the capacity of the main 
channel in the absence of the wiretapper. Furthermore, the capacity is achieved with a simple 
scheme where the source ignores the feedback signal and the destination feeds back randomly 
generated symbols from a certain alphabet set. This feedback signal plays the role of a private 
key, known only by the destination, and encryption is performed by the modulo-additive channel. 
The more challenging scenario with a half-duplex destination, which cannot transmit and receive 
simultaneously, is considered next. Here, the active transmission periods by the destination will 
introduce erasures in the feed-forward source-destination channel. In this setting, we propose a 
novel feedback scheme that achieves a positive perfect secrecy rate for any non-trivial channel 
distribution. The feedback signal in our approach acts as a private destination only key which 

3 The authors also considered a more general secret sharing problem. 
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strikes the optimal tradeoff between introducing erasures at the destination and errors at the 
wiretapper. Finally, the proposed scheme is extended to the continuous modulo-A lattice channel 
where it is shown to achieve the capacity of the main channel. Overall, our work proposes a 
novel approach for encryption where 1) the feedback signal is used as a private key known only 
to the destination and 2) the encryption is performed by exploiting the modulo-additive property 
of the channel. This encryption approach is shown to be significantly superior to the classical 
public discussion paradigm. 

Recently, there has been a resurgent interest in studying secure communications from in- 
formation theoretic perspective under various scenarios. The point-to-point fading eavesdropper 
channel was considered in [13]— [1 8] under different assumptions on the delay constraints and 
the available transmitter Channel State Information (CSI). In [19]— [22], the information theoretic 
limits of secure communications over multiple access channels were explored. The relay channel 
with confidential messages, where the relay acts both as a wiretapper and a helper, was studied 
in [23], [24]. In [25], the interference channel with confidential messages was studied. In [26], 
the four terminal relay-eavesdropper channel was introduced and analyzed. The wiretap channel 
with side information was studied in [27]. 

The rest of the paper is organized as follows. In Section HH we introduce the system model and 
our notation. Section [III] describes and analyzes the proposed feedback scheme which achieves 
the capacity of the full duplex modulo-additive DMC. Taking the Binary Symmetric Channel 
(BSC) as an example, we then compare the performance of the proposed scheme with the public 
discussion approach. The half-duplex scenario is studied in Section [IV] In Section |Vj we extend 
our results to the modulo-A lattice channel. Finally, Section |VT] offers some concluding remarks 
and outlines possible venues for future research. 

II. The Modulo-Additive Discrete Memoryless Channel 

Throughout the sequel, the upper-case letter X will denote a random variable, a lower-case 
letter x will denote a realization of the random variable, a calligraphic letter X will denote a finite 
alphabet set and a boldface letter x will denote a vector. Furthermore, we let [x] + = max{0, x}. 
Without feedback, our modulo-additive discrete memoryless wiretap channel is described by the 
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following relations at time % 

y (i) = x (i) +ni(i), 

z(i) = x(i) + n 2 (i), (1) 

where y(i) is the received symbol at the destination, z(i) is the received symbol at the wiretapper, 
x(i) is the channel input, nx(i) and n 2 (i) are the noise samples at the destination and wiretapper, 
respectively. Here N± and N 2 are allowed to be correlated, while each process is assumed 
to be individually drawn from an identically and independently distributed source. Also we 
have X e X = {0, 1, • • • , \X\ - 1}, Y, JVi G y = {0, 1, • • • , \y\ - 1} and Z, N 2 e Z = 
{0, 1, • • • , \Z\ — 1} with finite alphabet sizes \X\, \y\, \Z\ respectively. Here '+' is understood 
to be modulo addition with respect to the corresponding alphabet size, i.e., y(i) = [x(i) +n\(i)] 
mod \y\ and z(i) = [x(i) + n 2 (i)] mod \Z\ with addition in the real field. 

In this paper, we focus on the wiretap channel with noisy feedback. More specifically, at time 
i the destination sends the causal feedback signal Xi(i) over the same noisy channel used for 
feed-forward transmission, i.e., we do not assume the existence of a separate noiseless feedback 
channel. The causal feedback signal is allowed to depend on the received signal so far Y 1 ^ 1 , i.e., 
Xi(i) = ^>(Y l ~ l ), where ^ can be any (possibly stochastic) function. In general, we allow the 
destination to choose the alphabet of the feedback signal X 1 and the corresponding size \Xi\. 
With this noisy feedback from the destination, the received signal at the source, wiretapper and 
destination are 

y (i) = x(i) +x 1 (i) +n (i), 
y(i) = x(i) +x 1 (i) +ni(i), 

and 

z(i) = x(i) + xi(i) + n 2 (i), 

respectively. Here Y E y = {0, 1, • • • , |3^o| — 1} is the received noisy feedback signal at the 
source and N is the feedback noise, which may be correlated with Ni and N 2 . We denote the 
alphabet size of iVo and Y by 1 3^o I - Again, all '+' operation should be understood to be modulo 
addition with corresponding alphabet size. 

Now, the source wishes to send the message W e W = {1, • • • , M} to the destination using a 
(M, n) code consisting of: 1) a casual stochastic encoder / at the source that maps the message 
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w and the received noisy feedback signal y\ 1 to a codeword x£T with 

x(i) = f(i,w,yf 1 ), (2) 

2) a stochastic feedback encoder \T/ at the destination that maps the received signal into Xi(i) 
with xi(i) = ^(y' 1 ' 1 ) and 3) a decoding function at the destination d: y n — > W. The average 
error probability of the (M, n) code is 

P e n = -^Pr{d(y) 7^ m|iu was sent}. (3) 

U)£W 

The equivocation rate at the wiretapper is defined as 

R e = -H(W\Z). (4) 

n 

We are interested in perfectly secure transmission rates defined as follows. 

Definition 1: A secrecy rate Rf is said to be achievable over the wiretap channel with noisy 
feedback if for any e > 0, there exists a sequence of codes (M, n) such that for any n > n(e), 
we have 

Rf = -log 2 M, (5) 

n 

P: < e, (6) 

-H(W\Z) > R f -e. (7) 

n 

Definition 2: The secrecy capacity with noisy feedback C{ is the maximum rate at which 
messages can be sent to the destination with perfect secrecy; i.e. 

C[ = sup{R f : R f is achievable}. (8) 
Note that in our model, the wiretapper is assumed to have unlimited computation resources and 
to know the coding scheme of the source and the feedback function ^ used by the destination. 
We believe that our feedback model captures realistic scenarios where the terminals exchange 
information over noisy channels. 

III. The Wiretap Channel with Full-Duplex Feedback 
A. Known Results 

The secrecy capacity of the wiretap DMC without feedback C s was characterized in [5]. 
Specializing to our modulo-additive channel, one obtains 

C ° = v,iSj 7(F; Y) " I{V] Z)]+ - (9) 
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The wiretap DMC with public discussion was introduced and analyzed in [6], [7]. More 
specifically, these papers considered a more general model in which all the nodes observe 
correlated variables^, and there exists an extra noiseless public channel with infinite capacity, 
through which both the source and the destination can send information. Combining the correlated 
variables and the publicly discussed messages, the source and the destination generate a key about 
which the wiretap only has negligible information. Please refer to [7] for rigorous definitions 
of these notions. Since the public discussion channel is noiseless, the wiretapper is assumed to 
observe a noiseless version of the information transmitted over it. It is worth noting that some 
of the schemes proposed in [6], [7] manage only to generate an identical secret key at both the 
source and destination. The source may then need to encrypt its message using the one-time 
pad scheme which reduces the effective source-destination information rate. Thus, the effective 
secrecy rate that could be used to transmit information from the source to the destination may 
be less than the results reported in [6], [7]. Nevertheless, we use these results for comparison 
purposes (which is generous to the public discussion paradigm). The following theorem gives 
upper and lower bounds on the secret key capacity of the public discussion paradigm Cf . 

Theorem 3 ( [6], [7]): The secret key capacity of the public discussion approach satisfies the 
following conditions: 

max{max[/(X; F) - I(X; Z)],max[I(X;Y) -I(Y;Z)}} < C p s < min{max/(X; Y), maxI(X; Y\Z)}. 

Px Px ' Px Px 

Proof: Please refer to [6], [7]. ■ 
These bounds are known to be tight in the following cases [6], [7]. 

1) Pyz\x = Py\xPz\x, i-e., the main channel and the source-wiretapper channel are inde- 
pendent; in this case 

C p s = max{I(X;Y)-I(Y;Z)}. (10) 

Px 

2) Pxz\y = Px\yPz\y, i-e-, X — > Y — > Z forms a Markov chain, and hence the source- 
wiretapper channel is a degraded version of the main channel. In this case 

C p s = max{/(X; Y) - I(X; Z)}. (11) 

Px 

4 The wiretap channel model is a particular mechanism for the nodes to observe the correlated variables, and corresponds to 
the "channel type model" studied in [7]. 
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This is also the secrecy capacity of the degraded wiretap channel without feedback. Hence 
public discussion does not increase the secrecy capacity for the degraded wiretap channel. 
3) Pxy\z = Px\zPy\z, X — > Z — > Y, so that the main channel is a degraded version of 
the wiretap channel. In this case 



Again, public discussion does not help in this scenario. 
B. The Main Result 

Before presenting the main theorem, we present the crypto lemma which will be intensively 
used later. 

Lemma 4 (Crypto Lemma [28]): Let G be a compact abelian group with group operation '+', 
and let Y = X + X\, where X and X\ are random variables over G and X\ is independent of 
X and uniform over G. Then Y is independent of X and uniform over G. 

Proof: Please refer to [28]. ■ 

The following theorem characterizes the secrecy capacity of the wiretap channel with noisy 
feedback. Moreover, achievability is established through a novel encryption scheme that exploits 
the modulo-additive structure of the channel and uses a private key known only to the destination. 

Theorem 5: The secrecy capacity of the discrete memory less modulo-additive wiretap channel 
with noisy feedback is 



C* = 0. 



(12) 



C{ = C, 



(13) 



where C is the capacity of the main channel in the absence of the wiretapper. 
Proof: 



1. Converse 



Let 



TV 



{W : there exists a coding scheme that satisfies ©-CD) for R*}. 



(14) 



Also, let 



K 



{R : there exists a coding scheme that satisfies ©-© for R}. 



(15) 
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Obviously VJ C 1Z, since we are dropping off the equivocation condition ©, i.e., we are 
ignoring the wiretapper. Hence we have C[ = sup VJ < sup 1Z. It is clear that 1Z is the set 
of reliable transmission rate of an ordinary DMC channel with feedback. It is well known that 
feedback does not increase the capacity of discrete memoryless channels, hence we have 

C{ = sup VJ < sup K = C. (16) 

2. Achievability. 

For any given input probability mass function p(x), we use the following scheme. 

1) Coding at the source. 

The source ignores the feedback signal and uses a channel coding scheme for the ordinary 
channel without wiretapper. More specifically, the source generates M = 2 Rt length-n 
codewords x with probability 

n 

= JJp(x(z)). 

i=l 

When the source needs to send message w G W, it sends the corresponding codeword 
x(u>). 

2) Feedback at the destination. 

The destination sets X\ = Z, and at any time i sets Xi(i) = a, a G {0, • • • , \Z\ — 1} with 
probability 1/\Z\. Hence x 1 is uniformly distributed over Z n . 

3) Decoding at the destination. 

After receiving y, the destination sets y = y — x 1? here '— ' is understood to be a 
component- wise modulo \y\ operation. It is easy to see that y = x + rix. The destination 
then claims that w was sent, if (y,x(u>)) are jointly typical. For any given e > 0, the 
probability that w ^ w goes to zero, if Rf = I(X; Y)—e = I(X; Y\Xi) — e and n is large 
enough. The channel X — >• Y is equivalent to the main channel without feedback. Hence 
as long as < C, there exists a code with sufficient code-length such that P" < e for 
any e > 0. 

4) Equivocation at the wiretapper. 
The wiretapper will receive 

z = x + xi + n 2 , (17) 
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and x x is uniformly distributed over Z n and is independent with x. Based on the crypto 
lemma, for any given x, x + Xi is uniformly distributed over Z n , and hence z is uniformly 
distributed over Z n for any transmitted codeword x and noise realization n 2 . Moreover Z 
is independent with X, thus 

/(X;Z) = 0. (18) 
Hence we have I(W; Z) < /(X; Z) = 0, thus 

iw) = g(W °- /(W;Z) =^ d9> 

n n 
and we achieve perfect secrecy. 

This completes the proof. ■ 
The following observations are now in order. 

1) Our scheme achieves I(W; Z) = 0. This implies perfect secrecy in the strong sense of 
Shannon [1] as opposed to Wyner's notion of perfect secrecy [2], which has been pointed 
out to be insufficient for certain encryption applications [3]. 

2) The enabling observation behind our achievability scheme is that, by judiciously exploiting 
the modulo-additive structure of the channel, one can render the channel output at the 
wiretapper independent from the codeword transmitted by the source. Here, the feedback 
signal xx serves as a private key and the encryption operation is carried out by the channel. 
Instead of requiring both the source and destination to know a common encryption key, 
we show that only the destination needs to know the encryption key, hence eliminating 
the burden of secret key distribution. 

3) Remarkably, the secrecy capacity with noisy feedback is shown to be larger than the secret 
key capacity of public discussion schemes. This point will be further illustrated by the 
binary symmetric channel example discussed next. This presents a marked departure from 
the conventional wisdom, inspired by the data processing inequality, which suggests the 
superiority of noiseless feedback. This result is due to the fact that the noiseless feedback 
signal is also available to the wiretapper, while in the proposed noisy feedback scheme 
neither the source nor the wiretapper knows the feedback signal perfectly. In fact, the 
source in our scheme ignores the feedback signal, which is used primarily to confuse the 
wiretapper. 
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4) Our result shows that complicated feedback functions ^ are not needed to achieve optimal 
performance in this setting (i.e., a random number generator suffices). Also, the alphabet 
size of the feedback signal can be set equal to the alphabet size of the wiretapper channel 
and the coding scheme used by the source is the same as the one used in the absence of 
the wiretapper. 

C. The Binary Symmetric Channel Example 




Fig. 1. The Binary Symmetric Wiretap Channel. 

To illustrate the idea of encryption over the channel, we consider in some details the wiretap 
BSC shown in Figure DQ where X = y = Z = {0, 1}, Pr{rii = 1} = e and Pr{n 2 = 1} = 5. 
The secrecy capacity of this channel without feedback is known to be [6] 

C s = [H(8) - H(e)] + , 

with H(x) = — xlogx — (1 —x) log(l —x). We differentiate between the following special cases. 
1) e = 5 = 0. 

In this case, both the main channel and wiretap channel are noiseless, hence 

C s = 0. 

Also we have 

C? = 0, 

since the wiretapper sees exactly the same as what the destination sees. Specializing 
our scheme to this BSC channel, at time i, the destination randomly chooses x±(i) = 1 
with probability 1/2 and sends xi(i) over the channel. This creates a virtual BSC at the 
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wiretapper with 5 = 1/2. On the other hand, since the destination knows the value of 
xi(i), it can cancel it by adding x\(i) to the received signal. This converts the original 
channel to an equivalent BSC with e = 0. Hence, through our noisy feedback approach, 
we obtain an equivalent wiretap BSC with parameters e =0,5' = 1/2 resulting in 

C{ = H(5')-H(e') = l. 

2) < 5 < e < 1/2, Nx and N 2 are independent. 
Since 5 < e, we have 

C s = 0. 

Also, Ni and N 2 are independent, so Pyz\x = Py\xPz\x- Then from (flOl) . one can easily 
obtain that [6] 

C P = H(e + 5-2e5)-H(e). 
Our feedback scheme, on the other hand, achieves 

C{ = l-H(e). 

Since H(e + 5-2e5) < 1, we have C{ > C p s with equality if and only if e + 5-2e5 = 1/2. 

3) < 5 < e < 1/2 and N^i) = N 2 (i) + N'(i), where Pr{n'(i) = 1} = (e - 8)/{l - 25). 
The main channel is a degraded version of the source-wiretapper channel, X — > Z — >• Y, 
as shown in Figure [2l 

X Z Y 

/(l — 25) 



Fig. 2. The BSC Wiretap Channel with a Degraded Main Channel. 

Hence, from (fl"2l) . we have 

c s = C p s = 0, 

while G{ = 1-H(e). 

4) < e < <5 < 1/2, and iV 2 (i) = Nt{i) + N'{i), where Pr{n'(i) = 1} = (5 - e)/(l - 2e). 
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(S-€)/{l-2€) 



Fig. 3. The BSC wiretap Channel with a Degraded Source-Wiretapper Channel. 



In this case, the source-wiretapper channel is a degraded version of the main channel as 
shown in Figure [3l X — > Y — > Z, so from (fTTT) 

C s = C* = if(<f)-#(e). 

But 

C/ = 1 - H(e) > C* 

with equality if and only if 5 = 1/2. 
5) Ni and N 2 are correlated and the channel is not degraded. 
In this case 

C s = [H(5) - H(e)]+. 
The value of C v s is unknown in this case but can be bounded by 

C s = [H(S) - H(e)} + < C* < 1 - H(e) = C{. 

In summary, the secrecy capacity with noisy feedback is always larger than or equal to that of 
the public discussion paradigm when the underlying wiretap channel is a BSC. More strongly, 
the gain offered by the noisy feedback approach, over the public discussion paradigm, is rather 
significant in many relevant special cases. 

IV. Even Half-duplex Feedback is Sufficient 

It is reasonable to argue against the practicality of the full duplex assumption adopted in the 
previous section. For example, in the wireless setting, nodes may not be able to transmit and 
receive with the same degree of freedom due to the large difference between the power levels of 
the transmit and receive chains. This motivates extending our results to the half duplex wiretap 
channel where the terminals can either transmit or receive but never both at the same time. Under 
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this situation, if the destination wishes to feed back at time i, it loses the opportunity to receive 
the % th symbol transmitted by the source, which effectively results in an erasure (assuming that 
the source is unaware of the destination decision). The proper feedback strategy must, therefore, 
strike a balance between confusing the wiretapper and degrading the source-destination link. In 
order to simplify the following presentation, we first focus on the wiretap BSC. The extension 
to arbitrary modulo-additive channels is briefly outlined afterwards. 

In the full-duplex case, at any time i, the optimal scheme is to let the destination send x-y{i), 
which equals or 1 with probability 1/2 respectively. But in the half-duplex case, if the destination 
always keeps sending, it does not have a chance to receive information from the source, and 
hence, the achievable secrecy rate is zero. This problem, however, can be solved by observing 
that if at time i, Xi(i) = 0, the signal the wiretapper receives, i.e., 

z(i) = + n 2 (i), 

is the same as in the case in which the destination does not transmit. The only crucial difference 
in this case is that the wiretapper does not know whether the feedback has taken place or not, 
since x±(i) can be randomly generated at the destination and kept private. 

The previous discussion inspires the following feedback scheme for the half-duplex channel. 
The destination first fixes a faction < t < 1 which is revealed to both the source and wiretapper. 
At time i, the destination randomly generates X\{i) = 1 with probability t and X\{i) = with 
probability 1 — t. If x\(i) = 1, the destination sends x±(i) over the channel, which causes 
an erasure at the destination and a potential error at the wiretapper. On the other hand, when 
Xi(i) = 0, the destination does not send a feedback signal and spends the time on receiving 
from the channel. The key to this scheme is that although the source and wiretapper know t, 
neither is aware of the exact timing of the event x± — 1. The source ignores the feedback and 
keeps sending information. The following result characterizes the achievable secrecy rate with 
the proposed feedback scheme. 

Theorem 6: For a BSC with half-duplex nodes and parameters e and 5, the scheme proposed 
above achieves 



Rg = max 

fj,,t 



[1 - t) [H(e + fi - 2 fie) - H{e)] - [H{5 + fi - 2fi5) - H(S)] 
with 5 = 5 + t- 2St. 



(20) 
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Proof: For the main channel, if the destination spends a t fraction of its time on sending, 
the equivalent main channel is shown in Figure |4] with output y 6 {0, 0, 1}, where <p represents 
an erasure. The erasure probability is t. In the remaining l — t fraction of the time, the channel 
is a BSC with parameter e. Hence, the transition matrix of this equivalent channel is 

(l-f)(l-e) t (l-t)e 
(l_ t)e t (i_t)(l_ c ) 

Meanwhile for the wiretapper, the equivalent channel is still a BSC, but with the increased 
error probability 



6 = (1 - t)S + t{l - 5) = 5 + 1 - 25t. 



(21) 




Fig. 4. The Equivalent Main Channel. 

Hence the original BSC wiretap channel with noisy feedback is equivalent to a new wiretap 
channel X — ► (Y , Z) without feedback, and the channel parameters are given as above. 

As shown in [5], for this equivalent wiretap channel the following secrecy rate is achievable 
for any input distribution P x : 



Rf = [I(X;Y)-I(X;Z)}+. 
Hence, by using the input distribution Pr{X = 1} = fi, one can see that 

1 - t) [H(e + fi- 2/je) - H(e)] - [H(5 + fi - 2^8) - H(5)] 



= max 
fi,t 



(22) 



(23) 



is achievable. ■ 
In general, one can obtain the optimal values of \x and t by setting the partial derivative 
of Rf, with respect to [i and t to 0, and solving the corresponding equations. Unfortunately, 
except for some special cases, we do not have a closed form solution for these equations at 
the moment. Interestingly, using the not necessarily optimal choice of fj, — t — 1/2, we obtain 
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Rf — (1 — H(e))/2 implying that we can achieve a nonzero secrecy rate as long as e 7^ 1/2 
irrespective of the wiretapper channel conditions. Hence, even for half-duplex nodes, noisy 
feedback from the destination allows for transmitting information securely for almost any wiretap 
BSC. Finally, we compare the performance of different schemes in some special cases of the 
wiretap BSC. 

1) e = 5 = 0. 

As mentioned above, here we have C s = C P = 0. It is easy to verify that the optimal 
choice of /j, and t are 1/2, and we thus have R{ = 1/2. 

2) < 5 < e < 1/2 and N^i) = N 2 (i) + N'(i), where Pr{ra'(i) = 1} = (e - 8)/(l - 25). 
The main channel is a degraded version of the wiretap channel, so 

C s = C* = 0. (24) 

But by setting fi — t — 1/2 in our half-duplex noisy feedback scheme, we obtain R{ = 

(l-H(e))/2. 

The extension to the general discrete modulo-additive channel is natural. The destination can 
set X\ = Z, and generates x±(i) with certain distribution P Xl . At time i, if the randomly 
generated Xi(i) 7^ 0, the destination sends a feedback signal, incurring an erasure to itself. On 
the other hand, if Xi(i) = 0, it does not send the feedback signal and spends the time listening to 
the source. The achievable performance could be calculated based on the equivalent channels as 
done in the BSC. This scheme guarantees a positive secrecy capacity as seen in the case where 
Pxi is chosen to be uniformly distributed over Z. This is because a uniform distribution over 
Z renders the output at the wiretapper independent from the source input, i.e., I(W; Z) = 0, 
while the destination can still spend 1/\Z\ part of the time listening to the source. Finding the 
optimal distribution P Xl , however, is tedious. 

V. The Modulo-A Channel 

In this section, we take a step towards extending our approach to continuous valued channels. 
In particular, we consider the Modulo-A channel [29]-[32]. This choice is motivated by two 
considerations 1) this channel still enjoys the modulo structure which proved instrumental in 
deriving our results in the discrete case, and 2) the modulo-A channel has been shown to play an 
important role in achieving the capacity of the Additive White Gaussian Noise (AWGN) channel 
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using lattice coding/decoding techniques [31] (in other words, an AWGN source-destination 
channel can be well approximated by a Modulo- A channel). In the following, we show that, 
similar to the discrete case, noisy feedback can increase the secrecy capacity of the wiretap 
modulo-A channel to that of the main channel capacity in the absence of the wiretapper. 

Before proceeding further, we need to introduce few more definitions. An m-dimensional 
lattice A C W n is a set of points 

A = {A = Gu : u G Z m }, (25) 

where G G W nxm denotes the lattice generator matrix. A fundamental region f2 G R m of A is a 
set such that each x G IR m can be written uniquely in the form x = A + e with A G A, e G fi, and 
]R m = A + n. There are many different choices of the fundamental region, each with the same 
volume which will be denoted as V(A). Given a lattice A, a fundamental region f2 of A, and a 
zero-mean white Gaussian noise process with variance o\ per dimension, the mod-A channel is 
defined as follows [29]. 

Definition 7 ( [29]): The input of the mod-A channel consists of points X G f2; the output of 
the mod-A channel is Y = (X + Ni) mod A, where N x is an m-dimensional white Gaussian 
noise variable with variance a\ per dimension. Hence Y is the unique element of f2 that is 
congruent to X + N x . 

In our wiretap mod-A channel, the output at the wiretapper (in the absence of feedback) is also 
given by Z = (X + N 2 ) mod A. Here N 2 is an m-dimensional white Gaussian noise variable 
with variance o\ per dimension. Similar to Section [Til we consider noisy feedback, where the 
destination sends a feedback signal Xi G based on its received signal, and the received signal 
at the source is Y = (X + Xi + N ) mod A, where N is an m-dimensional white Gaussian 
noise with variance ctq per dimension. Now, the received signal at the destination and wiretapper 
are Y = (X + X 1 + Ni) mod A and Z = (X + Xi + N 2 ) mod A, respectively. 

For example, if m — 1, A = Z is a lattice in R, with [—1/2, 1/2) being one of its fundamental 
regions. With this lattice and fundamental region, the output at the destination is then Y = 
(X + Xi + Ni) mod A = X + X x + N x - [X + X 1 + Nt + 1 /2J , where N ± is a one-dimensional 
Gaussian random variable with variance a\. Here [^J denotes the largest integer that is smaller 
than x. One can easily check that Y G [1/2, 1/2). The output at the wiretapper and source can 
be written in a similar manner. This m = 1 example can be viewed as the continuous counterpart 
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of the discrete channels considered in Section [TTTJ 

Let N' = Ni mod A, and let / A o .2(n ) be the probability density function of N', one can 
easily verify that [29] 

/ A , CT? (n') = expHl n '+ b ll 2 /^ )n ' e n . (26) 

beA 

Denote the differential entropy of the noise term N' by h(A,af). Then 

fc(A,<7?) = - / / AjCTf (n')log/ A)fff (n')dn'. (27) 

JU(A) 

We are now ready to prove the following. 

Theorem 8: The secrecy capacity of mod-A channel with noisy feedback is 

C/ = log(V(A))-/i(A,<7?). (28) 
Proof: The proof follows along the same lines as that of Theorem [51 For the converse, (1281) 
was shown to be the capacity of the mod-A channel with the absence of the wiretap in [29], 
which naturally serves as an upper-bound for the secrecy capacity, as argued in the proof of 
Theorem [51 

To achieve this secrecy capacity, the source generates length-n codewords x, with the zth 
element x(z) being chosen uniformly from fi. Hence each codeword x G fi n C IR nxm . Now, 
at time i, the destination generates feedback signals Xi(i) with uniform distribution over the 
set f2, and thus the feedback signal Xi is uniformly distributed over f2 n . Based on the crypto 
lemma, for any codeword x and any particular noise realization ni, the length-n random variable 
received at the wiretapper 

Z = x + Xi + ni mod A, 

is uniformly distributed over Vt n and is independent with X. Hence, we have 

/(X; Z) = 0. (29) 

On the other hand, with X uniformly distributed over Vt n , the mutual information between X 
and Y given Xi (the destination knows Xi) is 

-J(X; Y|X X ) = log(V(A)) - h(A, of). (30) 
n 

So, for any e > 0, there exists a code with rate Rf = — e and I(M; Z) = 0. This completes 
the achievablity part. ■ 
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Our result for the modulo-A channel sheds some light on the more challenging scenario of 
the wiretap AWGN channel with feedback. The difference between the two cases results from 
the modulo restrictions imposed on the destination and wiretapper outputs. The first constraint 
does not entail any loss of generality due to the optimality of the modulo-A approach in the 
AWGN setting [31]. Relaxing the second constraint, however, poses a challenge because it 
destroys the modulo structure necessary to hide the information from the wiretapper (i.e., the 
crypto lemma needs the group structure). In other words, if the wiretapper is not limited by 
the modulo-operation then it can gain some additional information about the source message 
from its observations. Therefore, finding the secrecy capacity of the wiretap AWGN channel 
remains elusive (at the moment, we can only compute achievable rates using Gaussian noise as 
the feedback signal). 

VI. CONCLUSION 

In this paper, we have obtained the secrecy capacity (or achievable rate) for several instantia- 
tions of the wiretap channel with noisy feedback. More specifically, with a full duplex destination, 
it has been shown that the secrecy capacity of modulo-additive channels is equal to the capacity of 
the source-destination channel in the absence of the wiretapper. Furthermore, the secrecy capacity 
is achieved with a simple scheme in which the destination randomly chooses its feedback signal 
from a certain alphabet set. Interestingly, with a slightly modified feedback scheme, we are able 
to achieve a positive secrecy rate for the half duplex channel. Overall, our work has revealed a 
new encryption paradigm that exploits the structure of the wiretap channel and uses a private 
key known only to the destination. We have shown that this paradigm significantly outperforms 
the public discussion approach for sharing private keys between the source and destination. 

Our results motivate several interesting directions for future research. For example, character- 
izing the secrecy capacity of arbitrary DMCs (and the AWGN channel) with feedback remains an 
open problem. From an algorithmic perspective, it is also important to understand how to exploit 
different channel structures (in addition to the modulo-additive one) for encryption purposes. 
Finally, extending our work to multi-user channel (e.g., the relay-eavesdropper channel [26]) is 
of definite interest. 
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